Cloudflare OS goes open source with a record of everything its agents read
Cloudflare open sourced Cloudflare OS, the agent platform whose first version its own employees have used since May.
Every resource an agent reads gets recorded, the record follows whatever the agent produces, and when a second person opens that output the platform checks them against the underlying data first. An agent builds a live dashboard from a sensitive warehouse table, a coworker opens the dashboard, and the coworker sees nothing unless they could have read the table themselves.
Model Context Protocol, the standard that lets an agent call tools on an outside service, tells you which tools an agent is allowed to invoke. It does not tell you which rows, files, or repositories the agent actually read. An agent can join data across two systems, hand the result to someone with fewer permissions, and leave no trace of what it touched. Cloudflare hit this internally once people started sharing workspaces and outputs with each other.
“Authorization has to account for where the data can go next,” Phillip Jones and Dan Carter write. Two repositories went up on GitHub: a core, and a starter deployment modeled on how Cloudflare runs the thing internally.
The credential never reaches the agent
Every agent and app inside Cloudflare OS starts with access to nothing. An agent asks for one resource, a person grants or denies it, and the generated code receives a typed binding standing for permission to use that resource under one policy. Server code runs in a Dynamic Worker with outbound networking switched off. Client code runs in a sandboxed browser frame. Neither can reach the internet except through a capability you hand over.
A service-specific Worker called a Gatekeeper does the holding. It sits between the platform and an external API, completes the OAuth handshake, keeps the credential, enforces policy, and logs what was read. Point one at GitHub and you can scope an agent to a single repository, let it read issues but not source code, mask particular fields, apply rate limits, and require human approval before a pull request merges. The agent sees a small TypeScript API and never touches the key.
The piece that answers the dashboard problem is the observation log. Every resource an agent reads gets recorded, and the record stays attached to the agent and to whatever it produced. When a second person opens the workspace or the output, Gatekeepers check that person against the observed resources before showing anything. The same log drives outbound rules, so an agent that has read sensitive data can be blocked from writing to certain destinations, inviting new collaborators, handing the job to another agent, or making an external request.
Every file can be an app
A workspace can build software. Ask for an app and the agent writes client code for the interface and server code for state and behavior, loaded on demand as a Dynamic Worker and instantiated as a Durable Object Facet, a pairing Cloudflare built for this project. The facet gives each app its own SQLite database. Because Dynamic Workers use lightweight V8 isolates, every app gets an isolated runtime without a container or server idling behind it.
The browser talks to the server over Cap’n Web, Cloudflare’s open source object-capability RPC system, which lets a client call a server method as if it were a local function. The agent can call the same method. “So if you can build a tool to do a job yourself, agents can use your tool to do the job when you’re not there,” Jones and Carter write.
Apps are private by default and can be shared two ways. Share the app and colleagues collaborate on the same live state. Share a blueprint and they get a copy of the code with none of the SQLite data, conversation history, credentials, or connected resources. Someone who wants a change makes it with an agent instead of filing a request against you.
What you still have to build
Model choice runs through Cloudflare AI Gateway, which is where an administrator picks which models are available, attributes every inference call to a person, team, or workspace, and sets budgets and rate limits. The stated reason is cost: summarizing your unread mail every morning does not need a frontier model.
Cloudflare OS is not yet a product you can turn on from the dashboard. A managed version, containers for development workflows, and workspaces inside Slack are all still ahead. Presidio and Happy Cog, named as strategic partners, will do rollouts for organizations that want the context, skills, and internal integrations built for them.
Cloudflare OS is available on GitHub.